diff options
| author | Alexey Khoroshilov <khoroshilov@ispras.ru> | 2022-03-04 19:25:36 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2022-03-05 13:04:14 +0100 |
| commit | c6a502c2299941c8326d029cfc8a3bc8a4607ad5 (patch) | |
| tree | ceac43f3f5a0351f3724fb8960e6765de19647c9 /drivers/isdn | |
| parent | net: phy: meson-gxl: fix interrupt handling in forced mode (diff) | |
| download | linux-c6a502c2299941c8326d029cfc8a3bc8a4607ad5.tar.xz linux-c6a502c2299941c8326d029cfc8a3bc8a4607ad5.zip | |
mISDN: Fix memory leak in dsp_pipeline_build()
dsp_pipeline_build() allocates dup pointer by kstrdup(cfg),
but then it updates dup variable by strsep(&dup, "|").
As a result when it calls kfree(dup), the dup variable contains NULL.
Found by Linux Driver Verification project (linuxtesting.org) with SVACE.
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Fixes: 960366cf8dbb ("Add mISDN DSP")
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/isdn')
| -rw-r--r-- | drivers/isdn/mISDN/dsp_pipeline.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/isdn/mISDN/dsp_pipeline.c b/drivers/isdn/mISDN/dsp_pipeline.c index e11ca6bbc7f4..c3b2c99b5cd5 100644 --- a/drivers/isdn/mISDN/dsp_pipeline.c +++ b/drivers/isdn/mISDN/dsp_pipeline.c @@ -192,7 +192,7 @@ void dsp_pipeline_destroy(struct dsp_pipeline *pipeline) int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) { int found = 0; - char *dup, *tok, *name, *args; + char *dup, *next, *tok, *name, *args; struct dsp_element_entry *entry, *n; struct dsp_pipeline_entry *pipeline_entry; struct mISDN_dsp_element *elem; @@ -203,10 +203,10 @@ int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) if (!list_empty(&pipeline->list)) _dsp_pipeline_destroy(pipeline); - dup = kstrdup(cfg, GFP_ATOMIC); + dup = next = kstrdup(cfg, GFP_ATOMIC); if (!dup) return 0; - while ((tok = strsep(&dup, "|"))) { + while ((tok = strsep(&next, "|"))) { if (!strlen(tok)) continue; name = strsep(&tok, "("); |